[dylanneve1]

Issue 68 asked why -snapshot failed in the app with "Could not open .../cache/vl.XXXX" (seen in the exec-path re-check at the end of PR 66). That failure doesn't come from the app. Both launch paths already put the overlays in the cache dir and work. The message appears when QEMU runs as a uid other than the app's, for example from adb shell, with TMPDIR set to the app's cache dir. The cache dir is drwxrws--x u0_aNNN u0_aNNN_cache, so the shell user can't create files in it.

What changed:

• QemuCommand.env(tmpDir, settings) builds QEMU's environment (TMPDIR, QEMU_VCPU_AFFINITY). The child process and the in-process :vm path both use it, where each path used to build its own. There is no behaviour change.
• New QemuEnvTest: TMPDIR is the cache dir on both paths, the auto vCPU affinity follows smp, and an empty affinity is left out.
• docs/PHONE-SMOKE.md: a note on -snapshot and TMPDIR for QEMU run by hand, and on the harmless SELinux ioctl 0x581f (FS_IOC_FSGETXATTR) denial logged once per overlay.

No Pyre change is needed. create_tmp_file in block.c is upstream code and behaves correctly on bionic.

How it was tested (shared emulator, sdk_gphone64_arm64, API 36, using the main CI APK from run 40935281916):

• Exec path in the app, in-process off: a dummy VM folder with fake IMG4 headers and blank disks (no Apple files), started through the debug vm_dir extra, with -snapshot added from files/qemu-extra-args.txt. All 9 drives (2 pflash, 7 NVMe) got overlays in /data/data/<pkg>/cache/vl.*, as the SELinux audit lines show. QEMU then got past the block layer and crashed on the fake kernel (exit 139), as expected. There was no temp-file error.
• In-process path, same folder with in_process on: the same 9 overlays were created in the cache dir by qemu-main in the :vm process. The process then crashed on the fake kernel.
• run-as <pkg> with TMPDIR=<cache> and the bundled binary (-M a13-test -snapshot -drive ...): info block shows the overlay .../cache/vl.ZEWAY3, and QEMU exits 0.
• Reproduced the issue's message: the same command from plain adb shell (uid shell) with TMPDIR=<app cache> gives Could not open temporary file '/data/user/0/io.github.dylanneve1.iosonpixel/cache/vl.30W2X3': Permission denied.

Not tested:

• The unit test was not run locally. CI's testDebugUnitTest runs it.
• This PR's APK was not tested on the emulator. The change only moves the env construction, and the test covers it.
• A real boot with -snapshot on the Pixel 10. That needs a check by Dylan, though nothing here is device-specific.

Closes #68